{"id":833,"date":"2012-07-31T08:44:57","date_gmt":"2012-07-31T00:44:57","guid":{"rendered":"http:\/\/rmohan.com\/?p=833"},"modified":"2012-07-31T08:46:30","modified_gmt":"2012-07-31T00:46:30","slug":"vpn-server-with-openvpn","status":"publish","type":"post","link":"https:\/\/mohan.sg\/?p=833","title":{"rendered":"VPN Server With OpenVPN"},"content":{"rendered":"

Depending on your circumstances you may want to run the VPN from your home, or you may want to rent a VPS to run it from. If you\u2019re just trying to get into your home network, an SSH tunnel might be easier; I will write something about SSH tunneling later. For the purposes of this guide, there\u2019s no difference between using a spare machine at your house or a VPS\/Dedi other than port forwarding on the router. The configuration will be based on a machine running CentOS 5, with nano as the editor. It really doesn\u2019t matter what Linux distribution you use, or what editor. I also use wget for downloading. You can use Links, lynx, or any method you want to get the files.<\/p>\n

OpenVPN is being used for a number of reasons:<\/p>\n

    \n
  1. It\u2019s extensively used privately and publicly.<\/li>\n
  2. It\u2019s well supported<\/li>\n
  3. It uses OpenSSL instead of more complicated PKI certificate systems. (Don\u2019t confuse this with a Microsoft SSTP VPN, they aren\u2019t the same thing)<\/li>\n
  4. This type of VPN can be tunneled through a proxy or NAT device easily.<\/li>\n
  5. It is a very capable VPN application, allowing for a large number of configuration scenarios including site to site, client to server, client to site, and reverse connections.<\/li>\n<\/ol>\n
    Now, there is one huge drawback\u2026 It uses its own special set of protocols, and cannot be intermixed with other VPN clients or servers. An OpenVPN client cannot connect to an IPSec, PPTP, or SSTP VPN, and only OpenVPN clients can connect to OpenVPN servers. That being said, there are several third party clients available for OpenVPN, for all platforms. I will list the various options at the end of the article.<\/div>\n

    Please read the entire guide before beginning the installation.<\/p>\n

    1. Downloading and installing OpenVPN<\/strong><\/div>\n
    \n

    #wget\u00a0openvpn-as-1.8.3-CentOS5.i386.rpm<\/a><\/p><\/blockquote>\n<\/div>\n

    \n
    \n

    #rpm -i openvpn-as-1.8.3-CentOS5.i386.rpm<\/p>\n<\/div>\n<\/blockquote>\n

    I\u2019m just downloading and installing one of the RPMs, but you can easily build from source if that\u2019s your style. The package should also be in most distro software repositories as well. The basic installation is insanely simple, just download and install the package. The installation will let you know that you need to change the password using \u201cpasswd openvpn\u201d, and that web UIs are available at https:\/\/serveraddress:943\/ and\u00a0https:\/\/serveraddress:943\/admin for the user and admin logins respectively.<\/p>\n

    2. Configuration of the VPN Server.<\/strong><\/p>\n

    If you haven\u2019t already set the password, please do so now.<\/p>\n

    #passwd openvpn<\/p>\n

    Changing password for user openvpn<\/p>\n

    New UNIX password:<\/p>\n

    BAD PASSWORD: it is based on a dictionary word<\/p>\n

    Retype UNIX password:<\/p>\n

    passwd: all authentication tokens updated successfully<\/p><\/blockquote>\n

    I used \u201cpassword\u201d for my password, I\u2019d advise that you actually use a strong password.<\/p>\n

    OpenVPN is now running on your server. Everything can be configured via the web interface available at https:\/\/server:943\/admin. The user name is openvpn, and the password is whatever you have set. A basic VPN is already in place using default certificates, PAM authentication, and a relatively secure client configuration. \u00a0I\u2019m not going to cover some of the more advanced configurations here, such as site to site via an intermediary server, LDAP interoperability, or layer 2 tunneling.<\/p>\n

    If you\u2019re having trouble reaching the VPN administration page, you\u2019ll need to check your firewall settings. I\u2019m not going to go through iptables commands, but you need to make sure that the bare minimum is present. The administration page provides a simple means to configure everything from client IP ranges to ciphers and authentication. The only thing you might *need* to change is the IP range.<\/p>\n

    #!\/bin\/bash<\/p>\n

    ###### TURN ON PORT FORWARDING ########
    \necho 1 > \/proc\/sys\/net\/ipv4\/ip_forward<\/p>\n

    iptables -v -F;
    \niptables -F -t mangle
    \niptables -F -t nat;
    \niptables -v -A INPUT -i lo -j ACCEPT;<\/p>\n

    # iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
    \n# iptables -t nat -A POSTROUTING -s 192.168.1.0\/24 -j MASQUERADE
    \n# iptables -t nat -A POSTROUTING -s 192.168.25.0\/24 -o tun0 -j MASQUERADE<\/p>\n

    # iptables -A INPUT -i tun0 -j ACCEPT
    \n# iptables -A OUTPUT -o tun0 -j ACCEPT
    \n# iptables -A FORWARD -i tun0 -j ACCEPT
    \n# iptables -I FORWARD -i em1 -o tun0 -j ACCEPT
    \n# iptables -I FORWARD -i tun0 -o em1 -j ACCEPT<\/p>\n

    ########### BASIC RULE SET #############
    \niptables -v -P INPUT DROP # Default Policy DROP
    \n# iptables -v -A INPUT -m state \u2013state RELATED,ESTABLISHED -j LOG \u2013log-prefix \u201cACCEPT\u201d
    \niptables -v -A INPUT -m state \u2013state RELATED,ESTABLISHED -j ACCEPT; # ACCEPT ESTABLISHED
    \niptables -A INPUT -p tcp -m state \u2013state NEW \u2013dport 80 -i em1 -j ACCEPT
    \niptables -A INPUT -i em1 -p tcp \u2013dport 993 -m state \u2013state NEW,ESTABLISHED -j ACCEPT #ALLOW SSL
    \niptables -A INPUT -i em1 -p tcp \u2013dport 1194 -m state \u2013state NEW,ESTABLISHED -j ACCEPT #ALLOW OPENVPN<\/p>\n

    ########## CONNECTION LIMIT LOG\/DROP ############
    \niptables -A INPUT -p tcp -i em1 -m state \u2013state NEW -m recent \u2013set
    \niptables -A INPUT -p tcp -i em1 -m state \u2013state NEW -m recent \u2013update \u2013seconds 30 \u2013hitcount 10 -j LOG \u2013log-level 4 \u2013log-prefix \u201cLIMIT:\u201d
    \niptables -A INPUT -p tcp -i em1 -m state \u2013state NEW -m recent \u2013update \u2013seconds 30 \u2013hitcount 10 -j DROP<\/p>\n

    ########### DROP SPOOFED PACKETS ###############
    \niptables -A INPUT -s 127.0.0.0\/8 ! -i lo -j LOG \u2013log-level 4 \u2013log-prefix \u201cSPOOF PACKETS:\u201d
    \niptables -A INPUT -s 127.0.0.0\/8 ! -i lo -j DROP<\/p>\n

    ########### LOG\/DROP NEW CONNECTIONS ##############
    \n# iptables -A INPUT -p tcp -m state \u2013state NEW -j LOG # LOG NEW TCP CONNECTIONS
    \n# iptables -A INPUT -p tcp -m state \u2013state NEW -j DROP # BLOCK NEW TCP CONNECTIONS<\/p>\n

    ######### LOG\/DROP FTP SSH AND SEDMAIL ############
    \niptables -v -A INPUT -p tcp -s 0\/0 \u2013dport 21 -j LOG # LOG FTP ATTEMPTS
    \niptables -v -A INPUT -p tcp -s 0\/0 \u2013dport 21 -j REJECT \u2013reject-with tcp-reset # RESET FTP
    \niptables -v -A INPUT -p tcp -s 0\/0 \u2013dport 22 -j LOG # LOG SSH ATTEMPTS
    \niptables -v -A INPUT -p tcp -s 0\/0 \u2013dport 22 -j DROP # BLOCK SSH
    \niptables -v -A INPUT -p tcp -s 0\/0 \u2013dport 25 -j LOG # LOG SENDMAIL
    \niptables -v -A INPUT -p tcp -s 0\/0 \u2013dport 25 -j DROP # BLOCK SENDMAIL<\/p>\n

    ########### INPUT THAT IS NEEDED #################
    \niptables -v -A INPUT -m state -m tcp \u2013proto tcp \u2013dport 80 \u2013state NEW -j ACCEPT; # HTTP
    \niptables -v -A INPUT -m state -m udp \u2013proto udp \u2013dport 53 \u2013state NEW -j ACCEPT; # DNS
    \niptables -v -A INPUT -m state -m tcp \u2013proto tcp \u2013dport 53 \u2013state NEW -j ACCEPT; # DNS<\/p>\n

    iptables -v -A INPUT -m state -m tcp \u2013proto tcp \u2013dport 22 \u2013state NEW -j ACCEPT; # SSH<\/p>\n

    iptables -v -A INPUT -m state -m tcp \u2013proto tcp \u2013dport 443 \u2013state NEW -j ACCEPT; # HTTPS<\/p>\n

    ########### DENY FRAGMENT PACKETS ###############
    \niptables -A INPUT -i em1 -f -m limit \u2013limit 5\/m \u2013limit-burst 7 -j LOG \u2013log-level 4 \u2013log-prefix \u201cFRAG DROP:\u201d
    \niptables -A INPUT -i em1 -f -j DROP<\/p>\n

    ########### DROPS BAD PACKETS ###############
    \niptables -A INPUT -p tcp \u2013tcp-flags ALL ALL -j DROP
    \niptables -A INPUT -p tcp \u2013tcp-flags ALL NONE -j DROP
    \niptables -A INPUT -i em1 -p tcp \u2013tcp-flags ALL FIN,URG,PSH -j DROP
    \niptables -A INPUT -i em1 -p tcp \u2013tcp-flags ALL ALL -j DROP<\/p>\n

    iptables -A INPUT -i em1 -p tcp \u2013tcp-flags ALL NONE -m limit \u2013limit 5\/m \u2013limit-burst 7 -j LOG \u2013log-level 4 \u2013log-prefix \u201cNULL DROP:\u201d
    \niptables -A INPUT -i em1 -p tcp \u2013tcp-flags ALL NONE -j DROP # NULL packets<\/p>\n

    iptables -A INPUT -i em1 -p tcp \u2013tcp-flags SYN,RST SYN,RST -j DROP<\/p>\n

    iptables -A INPUT -i em1 -p tcp \u2013tcp-flags SYN,FIN SYN,FIN -m limit \u2013limit 5\/m \u2013limit-burst 7 -j LOG \u2013log-level 4 \u2013log-prefix \u201cXMAS DROP:\u201d
    \niptables -A INPUT -i em1 -p tcp \u2013tcp-flags SYN,FIN SYN,FIN -j DROP #XMAS<\/p>\n

    iptables -A INPUT -i em1 -p tcp \u2013tcp-flags FIN,ACK FIN -m limit \u2013limit 5\/m \u2013limit-burst 7 -j LOG \u2013log-level 4 \u2013log-prefix \u201cFIN DROP:\u201d
    \niptables -A INPUT -i em1 -p tcp \u2013tcp-flags FIN,ACK FIN -j DROP # FIN packet scans<\/p>\n

    iptables -A INPUT -i em1 -p tcp \u2013tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP<\/p>\n

    ########### LIMIT PING ATTEMPTS ###################
    \niptables -A INPUT -p icmp -m icmp -m limit \u2013limit 1\/second -j ACCEPT<\/p>\n

    ########### BLOCK CERTAIN ICMP ###################
    \niptables -v -A INPUT -p icmp -j ACCEPT # ACCEPT ICMP PACKETS
    \niptables -v -A INPUT -p icmp \u2013icmp-type echo-request -j DROP # BLOCK ICMP ECHO<\/p>\n

    ########## BLOCK INVALID ICMP #####################
    \niptables -v -A INPUT -i em1 -m state -p icmp \u2013state INVALID -j DROP # BLOCK INVALID ICMP
    \niptables -v -A FORWARD -i em1 -m state -p icmp \u2013state INVALID -j DROP # BLOCK INVALID ICMP
    \niptables -A OUTPUT -o em1 -m state -p icmp \u2013state INVALID -j DROP # BLOCK INVALID ICMP
    \niptables -A FORWARD -o em1 -m state -p icmp \u2013state INVALID -j DROP # BLOCK INVALID ICMP<\/p>\n

    ############ BLOCK STEALTH SCAN ###################
    \niptables -N st_scan # STEALTH SCAN CHAIN
    \niptables -A st_scan -p tcp \u2013tcp-flags SYN,FIN,RST,ACK RST,ACK -j RETURN # BLOCK STEALTH SCAN
    \niptables -A st_scan -j LOG \u2013log-level 4 \u2013log-prefix \u201cSTEALTH SCAN:\u201d # LOG STEALTH SCAN
    \niptables -A st_scan -j DROP # DROP STEALTH SCAN<\/p>\n

    ########## PORTSCAN RULE SETUP ###################
    \niptables -N port-scan # BEGIN PORTSCAN RULES
    \niptables -A port-scan -p tcp \u2013tcp-flags SYN,ACK,FIN,RST RST -m limit \u2013limit 1\/s -j RETURN #BLOCK PSCAN
    \niptables -A port-scan -j LOG \u2013log-level 4 \u2013log-prefix \u201cPORT SCAN:\u201d # LOG PORT SCAN
    \niptables -A port-scan -j DROP # DROP PORT SCAN<\/p>\n

    ########## LOG ALL DROPPED PACKETS #################
    \niptables -N logdrop
    \niptables -A logdrop -j LOG \u2013log-level 4 \u2013log-prefix \u201cDROPPED:\u201d # LOG DROPPED PACKETS
    \niptables -A logdrop -j DROP<\/p>\n

    iptables -v -A INPUT -j REJECT; # REJECT EVERYTHING ELSE<\/p>\n

    ######## OUTPUT FOR SERVICES NEEDED ########<\/p>\n

    iptables -v -P OUTPUT ACCEPT # Default Policy Accept
    \niptables -v -A OUTPUT -o lo -j ACCEPT;
    \niptables -v -A OUTPUT -o em1 -j ACCEPT;
    \niptables -v -A OUTPUT -m tcp \u2013proto tcp \u2013dport 80 -j ACCEPT; # HTTP
    \niptables -v -A OUTPUT -m tcp \u2013proto tcp \u2013dport 443 -j ACCEPT; # HTTPS
    \niptables -v -A OUTPUT -m tcp \u2013proto tcp \u2013dport 445 -j ACCEPT; # SMB
    \niptables -v -A OUTPUT -m tcp \u2013proto tcp \u2013dport 53 -j ACCEPT; # DNS
    \niptables -v -A OUTPUT -m udp \u2013proto udp \u2013dport 53 -j ACCEPT; # DNS
    \niptables -v -A OUTPUT -m tcp \u2013proto tcp \u2013dport 5222 -j ACCEPT; #Google Talk or Jabber
    \niptables -v -A OUTPUT -m tcp \u2013proto tcp \u2013dport 5050 -j ACCEPT; #Yahoo
    \niptables -v -A OUTPUT -m tcp \u2013proto tcp \u2013dport 6667 -j ACCEPT; #IRC
    \niptables -v -A OUTPUT -m tcp \u2013proto tcp \u2013dport 7777 -j ACCEPT; #Jabber file Transfers
    \niptables -A OUTPUT -o em1 -p tcp \u2013dport 31337 \u2013sport 31337 -j DROP # BLOCK BACKDOOR
    \niptables -v -A OUTPUT -j REJECT;<\/p>\n

    ######### DEFAULT DROPS #######<\/p>\n

    iptables -v -P FORWARD DROP # Default Policy DROP
    \niptables -A FORWARD -p tcp -i em1 -m state \u2013state NEW -m recent \u2013set
    \niptables -A FORWARD -p tcp -i em1 -m state \u2013state NEW -m recent \u2013update \u2013seconds 30 \u2013hitcount 10 -j DROP
    \niptables -A FORWARD -p tcp \u2013syn -m limit \u2013limit 1\/s -j ACCEPT # SYN FLOOD PROTECT
    \niptables -A FORWARD -p icmp \u2013icmp-type echo-request -m limit \u2013limit 1\/s -j ACCEPT # DEATH BY PING
    \niptables -A FORWARD -p tcp -i em1 \u2013dport 31337 \u2013sport 31337 -j DROP # BLOCK BACKDOOR
    \niptables -v -A FORWARD -j REJECT; # DEFAULT REJECT<\/p>\n

    ######### IPTABLES SAVE ##################<\/p>\n

    iptables-save > \/tmp\/iptables;<\/p>\n

    iptables-restore < \/tmp\/iptables;<\/p>\n

    \/etc\/init.d\/iptables save<\/p>\n","protected":false},"excerpt":{"rendered":"

    Depending on your circumstances you may want to run the VPN from your home, or you may want to rent a VPS to run it from. If you\u2019re just trying to get into your home network, an SSH tunnel might be easier; I will write something about SSH tunneling later. For the purposes of this […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"_links":{"self":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/833"}],"collection":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=833"}],"version-history":[{"count":3,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/833\/revisions"}],"predecessor-version":[{"id":835,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/833\/revisions\/835"}],"wp:attachment":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=833"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=833"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=833"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}